DMARC alignment
Alignment is the part of DMARC that asks whether the domain that passed authentication is the same one the reader sees. A DKIM signature or an SPF check can pass for a domain that has nothing to do with the From header, and on its own that proves nothing. Alignment closes that gap by requiring the two to match, strictly or at the organisational level.
At a glance
- Category
- Domain authentication
- Compares
- The From domain against the DKIM or SPF domain
- Relaxed mode
- The organisational domain must match — the default
- Strict mode
- The domain must match exactly
- Set by
- The adkim and aspf tags in the DMARC record
- Specified in
- RFC 7489, section 3.1
How it works
DMARC evaluates two independent paths. For DKIM, it compares the domain in the signature against the domain in the From header. For SPF, it compares the envelope sender's domain against the same From header. Relaxed alignment, which is the default, accepts a match at the organisational domain, so a subdomain lines up with its parent. Strict alignment demands the labels be identical. DMARC passes if either path both authenticated and aligned; one aligned pass is enough.
Why it matters
Without alignment, authentication is a claim about the wrong thing. A message with your brand in the From header can carry a valid signature from a completely unrelated domain, and a naive check would call it authenticated. Alignment is what makes DMARC a statement about the identity a human actually reads. It is also the usual reason a message with a green DKIM tick still fails DMARC, which is the single most common confusion when a team first reads a report.
Example
A message shows hello@example.com in the From header. Its envelope sender is at a shared provider domain, so SPF passes for that provider and does not align. Its DKIM signature names send.example.com, which shares an organisational domain with example.com, so under relaxed alignment the DKIM path passes and aligns. DMARC therefore passes overall. Had the record asked for strict DKIM alignment, send.example.com would not have matched and the message would have failed.
Common mistakes
- 01Turning on strict alignment because it sounds safer, then failing every message signed by a sending subdomain.
- 02Reading a DKIM pass in a report as a DMARC pass, when the signing domain was never compared to the From header.
- 03Changing the From domain for a campaign without checking that the signing or envelope domain still aligns with it.
- 04Assuming alignment is decided by the display name, when only the domain to the right of the at sign is ever compared.
In Rasket
A verified domain signs with a key on that domain and uses a return path on a subdomain of it, so both DMARC paths align without extra configuration. Domains
Related terms
Frequently asked questions
Do I need both DKIM and SPF to align?
No. DMARC passes when either path authenticates and aligns. Having both aligned is still worth doing, because SPF breaks on forwarding and DKIM does not.
Should I use strict or relaxed alignment?
Relaxed is the default and is right for almost everybody, because it lets a sending subdomain align with the parent domain. Strict is for organisations that deliberately never send from a subdomain.
Why does my message pass DKIM but fail DMARC?
Almost always because the signing domain is not aligned with the From domain. Check which domain the signature names, and compare it with the one your readers see.
Sources
Last updated 16 September 2026.
Start sending this morning
Verify a domain and send your first email in minutes.